On 12 October 2026 the European Commission adopted the Cloud and AI Development Act, introducing a EU‑wide definition of “sovereign cloud” that expressly embraces partnership models. The Act amends the digital market framework by setting a uniform benchmark for jurisdiction‑controlled cloud offerings. Cloud service providers and organisations that process EU personal data in the cloud are now required to align their contracts with the new definition. The measure also limits the ability of providers to market “sovereignty‑washing” services without meeting the stipulated criteria.

Full News Breakdown

The Commission’s proposal was prompted by a surge of marketing claims that labelled hybrid services as sovereign despite lacking a common legal yardstick. Industry stakeholders disputed whether partnership‑based architectures could satisfy the EU’s data‑jurisdiction objectives. The Commission resolved the impasse by codifying a hybrid‑compatible definition and establishing a certification regime.

• Case Name: Cloud and AI Development Act (CADA) proposal

• Court: European Commission (Executive)

• Panel: Directorate‑General for Communications Networks, Content and Technology

• Date: 12 October 2026

• Citation: COM/2026/1024

• EU Instruments / UK Legislation Cited: Cloud and AI Development Act, General Data Protection Regulation, Digital Services Act

• Key Provisions: Art. 4 (definition of sovereign cloud); Art. 7 (certification procedure); Art. 12 (enforcement powers)

• Primary Legal Issue: Whether a hybrid partnership model can meet the EU’s sovereignty requirements

• Applicant/Plaintiff Arguments: Industry groups argued that the definition should be technology‑neutral and allow non‑EU components if data remains under EU jurisdiction.

• Respondent/Defendant Arguments: Consumer‑rights NGOs contended that any non‑EU technology undermines true sovereignty and should be excluded.

• Court's Reasoning: The Commission balanced territorial control with market‑realities, concluding that jurisdictional control over data and operational governance are the decisive factors, not the origin of every software layer.

• Holding: The Act adopts a definition that includes partnership models meeting the jurisdictional and operational criteria.

• Operative Order: The definition takes effect on 1 January 2027; certification bodies must be designated by 30 June 2027.

• Practical Outcome: CSPs such as IONOS, evoila and Uniserver can now market services built on Broadcom‑supplied VMware layers as sovereign, provided they retain EU‑based data‑centre control.

How Does This Affect You?

Previously, the absence of a statutory definition left providers free to label services as sovereign, creating regulatory uncertainty for data‑controllers. The Commission now clarifies that jurisdictional control and certified governance, rather than a wholly European‑built stack, constitute the legal benchmark. Consequently, compliance assessments can focus on certification status and data‑flow architecture, while mis‑labelled offerings become enforceable offences. The following sections translate the shift for distinct professional audiences.

For Lawyers & Advocates

• Amend data‑processing agreements to incorporate a clause referencing Art. 4 of the Act and the required certification number.

• Conduct a technical due‑diligence checklist that verifies EU‑data‑centre residency, governance controls, and the presence of a certified partnership model before advising on “sovereign” cloud procurement.

• Advise public‑sector clients to include the certification reference in tender specifications, thereby reducing the risk of award challenges based on non‑compliant cloud claims.

• Prepare evidential packages for supervisory authorities that demonstrate compliance with Art. 7, using the certification body’s audit report as primary support.

• Flag ongoing litigation concerning alleged “sovereignty‑washing” as a potential precedent for future enforcement actions, emphasizing the Commission’s new definitional test.

For Law Students

The case illustrates the Court of Justice’s approach to interpreting regulatory definitions that balance policy objectives with market feasibility. The core doctrinal focus is the distinction between territorial control and technological origin in data‑sovereignty regimes.
The decision is particularly relevant for the study of:

• EU Digital Law and the interplay between the Regulation and sector‑specific statutes

• Competition law implications of certification regimes

• Public procurement rules under the EU Procurement Directive

• Data‑protection compliance under the Regulation

• Emerging AI governance frameworks

Comparable cases include Schrems II (2020, CJEU) and Digital Services Act enforcement actions (2024, European Court of Justice), which together illuminate how courts assess cross‑border data‑flows and the weight of regulatory definitions in private‑law disputes.

For Businesses

• Cloud‑intensive firms in finance must update their risk‑assessment registers to record the certification status of each provider, or face heightened supervisory scrutiny.

• Multinational corporations should revisit their internal cloud‑strategy approvals, ensuring that any hybrid solution carries the EU certification before board sign‑off.

• IT procurement teams need to amend request‑for‑proposal templates to require the certification reference, preventing bids that rely solely on marketing labels.

• Companies that have already signed contracts with non‑certified providers should initiate a gap‑analysis to determine whether renegotiation or supplemental safeguards are necessary.

Key Takeaways

• The Act now defines “sovereign cloud” as a service that retains EU jurisdiction over data and meets a certification regime, closing the previous definitional gap.

• Practitioners must embed certification references in contracts, due‑diligence reports and procurement documents to demonstrate compliance.

• Supervisory authorities can levy fines for mis‑representation of sovereign status, and courts may grant injunctions based on the Act’s criteria.

• Watch for the European Parliament’s forthcoming amendment to the certification delegation procedure, expected in Q2 2027.

• In‑house counsel should audit all cloud‑service agreements by 31 December 2027 to verify inclusion of the new certification clause.

Source: How can Europe leverage laws to secure cloud sovereignty?